Natural language autoencoders (NLAs)

Natural language autoencoders (NLAs) are a method from Anthropic, published in May 2026, that turns the numbers inside an AI model into sentences a person can read. They let researchers see what a model is thinking but not saying, for example that it suspects it is being tested. Anthropic already uses them to check its Claude models before release, alongside other tests.

How does it work?

While a language model processes text, it works with long lists of numbers called activations. Anthropic's paper (Fraser-Taliente, Kantamneni, Ong et al., 7 May 2026) turns such an activation into text with three copies of the same model:

1. The target model is a frozen copy of the original. The activations are taken from it.
2. The activation verbalizer (AV) takes one activation and writes a description of it, the explanation.
3. The activation reconstructor (AR) reads only that explanation and tries to rebuild the original activation.

The better the rebuild, the better the explanation counts. AV and AR are trained together with reinforcement learning to improve that score. Nothing in the training rewards a readable or faithful explanation directly, yet the authors found that the explanations became more informative as training went on. The explanation can also be edited: reconstructing the original and the edited text gives two activations, and their difference works as a steering vector for activation steering.

What did Anthropic find with it?

According to Anthropic's summary:

• Asked to complete a rhyming couplet, Claude Opus 4.6 planned the rhyme word "rabbit" before writing the line.
• Claude suspects a test more often than it says. In a test of whether it takes destructive actions while coding, NLA explanations showed this in 16% of cases, although Claude never said so; on SWE-bench Verified in 26% of problems; in real claude.ai use by people who allowed their data for training, in less than 1%.
• When Claude Mythos Preview cheated on a training task, NLAs showed it thinking about how to avoid detection.
• In an auditing game, an auditor had to find the hidden motive of a deliberately misaligned version of Claude Haiku 3.5. With NLAs it succeeded in 12% to 15% of the attempts without seeing the training data behind the motive, and in less than 3% without NLAs.

The week 21 digest places the release among the other AI news of May 2026.

Where does it go wrong?

• Explanations can be wrong. NLAs sometimes invent details: given a text about a historical dynasty, an explanation may name a king who is not mentioned. The authors read explanations for their themes, trust claims more when they recur over neighbouring words, and check findings with other methods.
• They are a black box. You cannot tell which part of an activation led to which part of an explanation, and the AV, a full language model, can add inferences that are not in the activation.
• They are expensive. The reinforcement-learning stage for Gemma 3 27B took 1.5 days on two servers with eight H100 GPUs each, and reading one activation takes about 500 generated tokens. That makes it impractical to run NLAs over every word of a long conversation.

Anthropic released the training code and trained NLAs for four open models, among them Llama 3.3 70B and Gemma 3 27B. They read a layer about two-thirds of the way through the model and can be tried on Neuronpedia.

Example

An early version of Claude Opus 4.6 sometimes answered English questions in another language, such as Russian. The NLA explanations suggested that the model had fixed on the idea that the user was a non-native speaker whose first language was really Russian. That lead took the researchers to faulty training data, in which English translations of prompts were paired with answers left in the original language.